refactor: migrate to spec-compliant KERI SAID algorithm: replace empty-string placeholder with 44-char # placeholder, fix field-ordering for absent d fields under preserve_order, and update all call sites across the workspace

Author: bordumb

Cargo.lock

@@ -226,10 +226,10 @@ impl WitnessServerState {
             sig: vec![],
         };
 
-        let payload_for_said = receipt
-            .signing_payload()
+        let receipt_value = serde_json::to_value(&receipt)
+            .map_err(|e| WitnessError::Serialization(e.to_string()))?;
+        receipt.d = crate::crypto::said::compute_said(&receipt_value)
             .map_err(|e| WitnessError::Serialization(e.to_string()))?;
-        receipt.d = crate::crypto::said::compute_said(&payload_for_said);
 
         let signing_payload = receipt
             .signing_payload()
@@ -314,17 +314,10 @@ fn verify_event_said(event: &serde_json::Value) -> Result<(), String> {
         .and_then(|v| v.as_str())
         .ok_or("missing 'd' (SAID) field")?;
 
-    let mut zeroed = event.clone();
-    zeroed
-        .as_object_mut()
-        .ok_or("event must be a JSON object")?
-        .insert("d".to_string(), serde_json::Value::String(String::new()));
+    let computed = crate::crypto::said::compute_said(event)
+        .map_err(|e| format!("failed to compute SAID: {}", e))?;
 
-    let canonical =
-        serde_json::to_vec(&zeroed).map_err(|e| format!("failed to serialize event: {}", e))?;
-    let computed = crate::crypto::said::compute_said(&canonical);
-
-    if computed != claimed_d {
+    if computed.as_str() != claimed_d {
         return Err(format!(
             "SAID mismatch: claimed {} but computed {}",
             claimed_d, computed
@@ -678,13 +671,9 @@ mod tests {
         let sig = kp.sign(&payload);
         event["x"] = serde_json::Value::String(hex::encode(sig.as_ref()));
 
-        // Compute SAID (with empty d, but final x)
-        let mut for_said = event.clone();
-        for_said["d"] = serde_json::Value::String(String::new());
-        let said_payload = serde_json::to_vec(&for_said).unwrap();
-        event["d"] = serde_json::Value::String(
-            crate::crypto::said::compute_said(&said_payload).into_inner(),
-        );
+        // Compute SAID (x is already set; compute_said ignores x and injects d placeholder)
+        let said = crate::crypto::said::compute_said(&event).unwrap();
+        event["d"] = serde_json::Value::String(said.into_inner());
 
         event
     }
@@ -794,10 +783,8 @@ mod tests {
             "x": "not_valid_hex!!!"
         });
         // Set proper SAID for the event as-is
-        let said_payload = serde_json::to_vec(&event).unwrap();
-        event["d"] = serde_json::Value::String(
-            crate::crypto::said::compute_said(&said_payload).into_inner(),
-        );
+        let said = crate::crypto::said::compute_said(&event).unwrap();
+        event["d"] = serde_json::Value::String(said.into_inner());
 
         let response = app
             .oneshot(
@@ -839,13 +826,9 @@ mod tests {
         let sig = wrong_kp.sign(&payload);
         event["x"] = serde_json::Value::String(hex::encode(sig.as_ref()));
 
-        // Compute SAID
-        let mut for_said = event.clone();
-        for_said["d"] = serde_json::Value::String(String::new());
-        let said_payload = serde_json::to_vec(&for_said).unwrap();
-        event["d"] = serde_json::Value::String(
-            crate::crypto::said::compute_said(&said_payload).into_inner(),
-        );
+        // Compute SAID (x is already set; compute_said ignores x and injects d placeholder)
+        let said = crate::crypto::said::compute_said(&event).unwrap();
+        event["d"] = serde_json::Value::String(said.into_inner());
 
         let response = app
             .oneshot(

crates/auths-core/src/witness/server.rs

@@ -29,7 +29,7 @@ async fn start_test_server() -> (SocketAddr, WitnessServerState) {
 
 /// Build a valid KERI inception event with proper SAID and self-signature.
 /// Returns (event_json_bytes, computed_said).
-fn make_test_event(prefix: &str, seq: u64) -> (Vec<u8>, String) {
+fn make_test_event(prefix: &str, seq: u64) -> (Vec<u8>, auths_keri::Said) {
     let rng = ring::rand::SystemRandom::new();
     let pkcs8 = Ed25519KeyPair::generate_pkcs8(&rng).unwrap();
     let kp = Ed25519KeyPair::from_pkcs8(pkcs8.as_ref()).unwrap();
@@ -51,12 +51,9 @@ fn make_test_event(prefix: &str, seq: u64) -> (Vec<u8>, String) {
     let sig = kp.sign(&payload);
     event["x"] = serde_json::Value::String(hex::encode(sig.as_ref()));
 
-    // Compute SAID (with empty d, but final x)
-    let mut for_said = event.clone();
-    for_said["d"] = serde_json::Value::String(String::new());
-    let said_payload = serde_json::to_vec(&for_said).unwrap();
-    let said = auths_core::crypto::said::compute_said(&said_payload);
-    event["d"] = serde_json::Value::String(said.clone());
+    // Compute SAID (x is already set; compute_said ignores x and injects d placeholder)
+    let said = auths_core::crypto::said::compute_said(&event).unwrap();
+    event["d"] = serde_json::Value::String(said.as_str().to_string());
 
     (serde_json::to_vec(&event).unwrap(), said)
 }

crates/auths-core/tests/cases/witness.rs

@@ -28,10 +28,11 @@ use std::sync::Arc;
 use crate::storage::layout::StorageLayoutConfig;
 use crate::storage::registry::RegistryBackend;
 use crate::witness_config::WitnessConfig;
-use auths_core::crypto::said::{compute_next_commitment, compute_said, verify_commitment};
+use auths_core::crypto::said::{compute_next_commitment, verify_commitment};
 use auths_core::crypto::signer::{decrypt_keypair, encrypt_keypair};
 use auths_core::signing::PassphraseProvider;
 use auths_core::storage::keychain::{IdentityDID, KeyAlias, KeyRole, KeyStorage};
+use auths_keri::compute_said;
 
 /// Result of a rotation operation with keychain-specific info.
 pub struct RotationKeyInfo {
@@ -262,9 +263,10 @@ pub fn rotate_registry_identity(
         x: String::new(),
     };
 
-    let rot_json = serde_json::to_vec(&Event::Rot(rot.clone()))
+    let rot_value = serde_json::to_value(Event::Rot(rot.clone()))
         .map_err(|e| InitError::Keri(format!("Serialization failed: {}", e)))?;
-    rot.d = compute_said(&rot_json);
+    rot.d = compute_said(&rot_value)
+        .map_err(|e| InitError::Keri(format!("SAID computation failed: {}", e)))?;
 
     let canonical = serialize_for_signing(&Event::Rot(rot.clone()))
         .map_err(|e| InitError::Keri(e.to_string()))?;

crates/auths-id/src/identity/rotate.rs

@@ -7,7 +7,7 @@ use base64::{Engine, engine::general_purpose::URL_SAFE_NO_PAD};
 use git2::Repository;
 use ring::signature::Ed25519KeyPair;
 
-use auths_core::crypto::said::compute_said;
+use auths_keri::compute_said;
 
 use super::event::KeriSequence;
 use super::seal::SealType;
@@ -105,9 +105,10 @@ pub fn anchor_data<T: serde::Serialize>(
     let state = validate_kel(&events)?;
 
     // Compute data digest
-    let data_json =
-        serde_json::to_vec(data).map_err(|e| AnchorError::Serialization(e.to_string()))?;
-    let data_digest = compute_said(&data_json);
+    let data_value =
+        serde_json::to_value(data).map_err(|e| AnchorError::Serialization(e.to_string()))?;
+    let data_digest =
+        compute_said(&data_value).map_err(|e| AnchorError::Serialization(e.to_string()))?;
 
     // Create seal
     let seal = Seal::new(data_digest, seal_type);
@@ -125,9 +126,9 @@ pub fn anchor_data<T: serde::Serialize>(
     };
 
     // Compute SAID
-    let ixn_json = serde_json::to_vec(&Event::Ixn(ixn.clone()))
+    let ixn_value = serde_json::to_value(Event::Ixn(ixn.clone()))
         .map_err(|e| AnchorError::Serialization(e.to_string()))?;
-    ixn.d = compute_said(&ixn_json);
+    ixn.d = compute_said(&ixn_value).map_err(|e| AnchorError::Serialization(e.to_string()))?;
 
     // Sign the event with the current key
     let canonical = super::serialize_for_signing(&Event::Ixn(ixn.clone()))?;
@@ -231,9 +232,10 @@ pub fn verify_anchor<T: serde::Serialize>(
     data: &T,
 ) -> Result<AnchorVerification, AnchorError> {
     // Compute data digest
-    let data_json =
-        serde_json::to_vec(data).map_err(|e| AnchorError::Serialization(e.to_string()))?;
-    let data_digest = compute_said(&data_json);
+    let data_value =
+        serde_json::to_value(data).map_err(|e| AnchorError::Serialization(e.to_string()))?;
+    let data_digest =
+        compute_said(&data_value).map_err(|e| AnchorError::Serialization(e.to_string()))?;
 
     verify_anchor_by_digest(repo, prefix, data_digest.as_str())
 }
@@ -412,8 +414,8 @@ mod tests {
         .unwrap();
 
         // Compute the digest we're looking for
-        let att_json = serde_json::to_vec(&attestation).unwrap();
-        let att_digest = compute_said(&att_json);
+        let att_value = serde_json::to_value(&attestation).unwrap();
+        let att_digest = compute_said(&att_value).unwrap();
 
         let found = find_anchor_event(&repo, &init.prefix, att_digest.as_str()).unwrap();
         assert!(found.is_some());

crates/auths-id/src/keri/anchor.rs

@@ -13,7 +13,8 @@ use git2::Repository;
 use ring::rand::SystemRandom;
 use ring::signature::{Ed25519KeyPair, KeyPair};
 
-use auths_core::crypto::said::{compute_next_commitment, compute_said, verify_commitment};
+use auths_core::crypto::said::{compute_next_commitment, verify_commitment};
+use auths_keri::compute_said;
 
 use super::event::KeriSequence;
 use super::types::{Prefix, Said};
@@ -207,9 +208,9 @@ pub fn rotate_keys(
     };
 
     // Compute SAID
-    let rot_json = serde_json::to_vec(&Event::Rot(rot.clone()))
+    let rot_value = serde_json::to_value(Event::Rot(rot.clone()))
         .map_err(|e| RotationError::Serialization(e.to_string()))?;
-    rot.d = compute_said(&rot_json);
+    rot.d = compute_said(&rot_value).map_err(|e| RotationError::Serialization(e.to_string()))?;
 
     // Sign with the new current key (next_keypair is now the active key)
     let canonical = super::serialize_for_signing(&Event::Rot(rot.clone()))?;
@@ -319,9 +320,9 @@ pub fn abandon_identity(
     };
 
     // Compute SAID
-    let rot_json = serde_json::to_vec(&Event::Rot(rot.clone()))
+    let rot_value = serde_json::to_value(Event::Rot(rot.clone()))
         .map_err(|e| RotationError::Serialization(e.to_string()))?;
-    rot.d = compute_said(&rot_json);
+    rot.d = compute_said(&rot_value).map_err(|e| RotationError::Serialization(e.to_string()))?;
 
     // Sign with the new current key (next_keypair is now the active key)
     let canonical = super::serialize_for_signing(&Event::Rot(rot.clone()))?;
@@ -408,9 +409,9 @@ pub fn rotate_keys_with_backend(
         x: String::new(),
     };
 
-    let rot_json = serde_json::to_vec(&Event::Rot(rot.clone()))
+    let rot_value = serde_json::to_value(Event::Rot(rot.clone()))
         .map_err(|e| RotationError::Serialization(e.to_string()))?;
-    rot.d = compute_said(&rot_json);
+    rot.d = compute_said(&rot_value).map_err(|e| RotationError::Serialization(e.to_string()))?;
 
     let canonical = super::serialize_for_signing(&Event::Rot(rot.clone()))
         .map_err(|e| RotationError::Serialization(e.to_string()))?;

crates/auths-id/src/keri/rotation.rs

@@ -332,8 +332,8 @@ fn verify_anchor_by_digest_works() {
     .unwrap();
 
     // Compute digest
-    let att_json = serde_json::to_vec(&attestation).unwrap();
-    let digest = compute_said(&att_json);
+    let att_value = serde_json::to_value(&attestation).unwrap();
+    let digest = compute_said(&att_value).unwrap();
 
     // Verify by digest
     let verification = verify_anchor_by_digest(&repo, &init.prefix, digest.as_str()).unwrap();

crates/auths-id/tests/cases/keri.rs

@@ -0,0 +1,7 @@
+# Seeds for failure cases proptest has generated in the past. It is
+# automatically read and these particular cases re-run before any
+# novel cases are generated.
+#
+# It is recommended to check this file in to source control so that
+# everyone who runs the test benefits from these saved cases.
+cc 324d6750120f8135b6e66f4af19922d87ddf081902ce35bfbb0051af2d245dc8 # shrinks to ixn_count = 1

crates/auths-id/tests/cases/proptest_keri.proptest-regressions

@@ -62,8 +62,8 @@ fn make_signed_ixn(
         x: String::new(),
     };
 
-    let json = serde_json::to_vec(&Event::Ixn(ixn.clone())).unwrap();
-    ixn.d = compute_said(&json);
+    let value = serde_json::to_value(Event::Ixn(ixn.clone())).unwrap();
+    ixn.d = compute_said(&value).unwrap();
     ixn.x = sign_event(&Event::Ixn(ixn.clone()), kp);
     ixn
 }
@@ -91,8 +91,8 @@ fn make_signed_rot(
         x: String::new(),
     };
 
-    let json = serde_json::to_vec(&Event::Rot(rot.clone())).unwrap();
-    rot.d = compute_said(&json);
+    let value = serde_json::to_value(Event::Rot(rot.clone())).unwrap();
+    rot.d = compute_said(&value).unwrap();
     rot.x = sign_event(&Event::Rot(rot.clone()), new_kp);
     rot
 }

crates/auths-id/tests/cases/proptest_keri.rs

@@ -46,11 +46,9 @@ fn make_test_event(prefix: &str, seq: u64) -> (Vec<u8>, Said) {
     let sig = kp.sign(&payload);
     event["x"] = serde_json::Value::String(hex::encode(sig.as_ref()));
 
-    let mut for_said = event.clone();
-    for_said["d"] = serde_json::Value::String(String::new());
-    let said_payload = serde_json::to_vec(&for_said).unwrap();
-    let said = auths_core::crypto::said::compute_said(&said_payload);
-    event["d"] = serde_json::Value::String(said.to_string());
+    // Compute SAID (x is already set; compute_said ignores x and injects d placeholder)
+    let said = auths_core::crypto::said::compute_said(&event).unwrap();
+    event["d"] = serde_json::Value::String(said.as_str().to_string());
 
     (serde_json::to_vec(&event).unwrap(), said)
 }